Resting on Feet of Clay:
Securely Bootstrapping OPC UA Deployments
Alessandro Erba, Anne Müller, Nils Ole Tippenhauer
CISPA — Helmholtz Center for Information Security
Saarbrücken, GermanyIndustrial Control Systems security

Industrial Control Systems and Critical infrastructures are a valuable assets.
Process disruption may cause:• Arm human beings• Monetary loss

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

2 / 15ICS and Industrial Protocols security• Popular industrial protocols often do not support security features by design.
IE.g., Ethernet/IP, Modbus/TCP, PROFINET• Legacy Hardware and Software
IMissing support to security features• Sensors and actuators can drive the system to unsafe states
ISensors and actuator commands are not authenticated

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

3 / 15

OPC Unified Architecture (UA)• Industrial M2M protocol• Platform-independent• Secure communication
IAuthentication, encryption (different modes)• Developed by OPC foundation, current version 1.04 released in 2018
German BSI reviewed OPC UA security and found no systematic errors
Dahlmanns et al. (2020) found large numbers of insecure OPC UA systems online

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

4 / 15

Introduction to OPC UA security• Servers offer endpoints• Each endpoint can have own security

mode, security policy, and user identity• Security modes
INone, Sign, SingAndEncrypt• Security policies
IConcrete scheme, e.g., Basic256Sha256• User identity, authentication
II

User and Password
Certificate based

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

5 / 15

Example Addition of New Device

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

6 / 15

Example Addition of New Device

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

6 / 15

Example Addition of New Device

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

6 / 15

Example Addition of New Device

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

6 / 15

Example Addition of New Device

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

6 / 15

How is the Trust Bootstrapped?

• How does the new device get the trust root (e.g., cert of GDS)?
• On Internet, root CAs have their certs shipped in clients
INot possible for ICS setting (self-signed certs, no Internet)• How is this solved in practise?
• What are challenges to set up OPC UA security?
• How do libraries and OPC products
II

Recommend security configurations?
Address this trust root issue?

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

7 / 15

Review of artifacts’ OPC UA security features

We reviewed 48 OPC UA enabled products, to verify how and which security features
are implemented.

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

8 / 15

Review of artifacts’ OPC UA security features
Table:;/# product supports/not supports a feature. #G problems with feature configuration.

After a preprint release of this manuscript, the documentation related to the product was updated. Now it supports security and it is certified.
VendorPlatform

B&R
Bachmann
Beckoff
BeijerBosch Rexroth
General Electric
Honeywell
Lenze
Mitsubishi
National Instr.
Omron
Panasonic
RockwellSchneider
Siemens
Weidmüller
Yokogawa

ADI OPC UA
OPC UA Client/Serv.
TC3 OPC UA
iX Developer
ctrlX COREiFIX
ControlEdge Builder
Easy Starter
MX Configurator-R
InsightCM
SYSMAC-SE2
HMWIN Studio
Factory talk linx
Control Expert
STEP 7u-create studio
SMARTDAC+Codesys
ABB
EatonHitachi
Wago

Codesys V3.5
Automation Builder
XSOFT-CODESYSHX Codesys
e!cockpit

Alessandro Erba — Black Hat Europe, London 2021

OPC Cert.

Pub-Sub

GDS########
#
#
#
#
#
#
###;
#
####
####
#
#
#
#
#
############
Codesys based platforms############Security

Trust List

G#G###G#G#G#G###G#
G#G#G###G#G#G#G#G#Recommended Policy
Not specified
Not specified
Deprecated policy
None
None not supported
Basic256Sha256
None
Deprecated policy
None
None
Not specified
Not specified
Not specified
Basic256Sha256
Not specified
Basic256Sha256
None
Not specified
Basic256Sha256
Not specified
Not specified
Not specified

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

8 / 15

Review of artifacts’ OPC UA security features;Server certified, client not certified. *Denotes that the feature is going to be introduced in the next release

NameLang.

ASNeG
Eclipse Milo
Free OpcUA
LibUA
node-opcua
opc-ua-client
opcua
opcua
opcua
opcua4j
open62541
OpenScada UA
Python-opcua
S2OPC
UA.NET
UAexpert

C++
Java
C++
C#.js
C#
RustGolang
TypeScript
Java
C
C++
Python
C
C#
C++

OPC
Cert.

Pub
Sub

#
#
#
#
#
##
###
G
#;
##
G
#;

#*
#
#
##*
#
#
#
#
#

Alessandro Erba — Black Hat Europe, London 2021

###
#

GDS
#############Security#-ServerTrust List##

Demo App.

Security

-

#*

#
##G
#G#G
###----Client
Trust List##-Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

G#####G#

Demo App.
#
##G
#
G
#
G
###G
#G
#G
#

8 / 15

Review of artifacts’ OPC UA security features

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

8 / 15

Review of artifacts’ OPC UA security features

Security issues: Missing Support to Trust List
Exchange encrypted messages with untrusted parties

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

8 / 15

Review of artifacts’ OPC UA security features
Security issues: Trust List disabled by default

Source: SIEMENS S7-1500 OPC UA Server User Manual
Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

8 / 15

Review of artifacts’ OPC UA security features
Security issues: Insecure Trust List configuration

The OPC UA standard allows this behavior:• New certificates are stored in aquarantine list

• Assumes that trained personnel isauthorized to trust incoming
certificates.

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

8 / 15

Review of artifacts’ OPC UA security features
Security issues: Insecure Trust List configuration

The OPC UA standard allows this behavior:• New certificates are stored in aquarantine list

• Assumes that trained personnel isauthorized to trust incoming
certificates.

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

8 / 15

This is Fine

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

9 / 15

Attacks against OPC UA deployments

Rogue Server• The attacker impersonates a server on thenetwork• A new client is installed in the network• The benign client shares credentials withthe untrusted server• The benign client is fed with erroneous
sensor data

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

10 / 15

Attacks against OPC UA deployments
Rogue Client• The attacker impersonates a legitimate
client on the network• The malicious client is installed in thenetwork• The malicious client reads sensor readings
and process information• The malicious client issues commands tothe PLC

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

11 / 15

Attacks against OPC UA deployments

Middleperson attack

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

12 / 15

POC implementation• Implemented in Python
IPython OPC UA library• CLIFeatures:• Rogue Server• Rogue Client• Middle-person attack• Steal user credentials• Clone legitimate certificates
Available at https://github.com/
scy-phy/OPC-UA-attacks-POC

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

13 / 15

Discussion of possible countermeasures• Enable secure behaviors by default
IFrom opt-in security to security by default• Distribute certificates upon connection (Out-of-band)
I

Avoid server and client to start until the Trust List is populated• Add support for the missing security features

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

14 / 15

Conclusions• OPC UA offers security features• We have reviewed OPC UA enabled products
I

38/48 of the considered products present some security issues• Configuration of OPC UA deployments is challenging
Erroneous configuration enables attacks.
We have practically demonstrated them.
I An attacker can steal user credentials in plain text.
II• Impact: as reaction to our pre-print https://arxiv.org/abs/2104.06051
Several libraries/vendors already updated documentation
OPC UA documentation will likely be updated
I Certification process might also be reviewed
II

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

15 / 15

Conclusions• OPC UA offers security features• We have reviewed OPC UA enabled products
I38/48 of the considered products present some security issues• Configuration of OPC UA deployments is challenging
Erroneous configuration enables attacks.
We have practically demonstrated them.
I An attacker can steal user credentials in plain text.
II• Impact: as reaction to our pre-print https://arxiv.org/abs/2104.06051
Several libraries/vendors already updated documentation
OPC UA documentation will likely be updated
I Certification process might also be reviewedII

Thank you for your attention - Questions?

Alessandro Erba — Black Hat Europe, London 2021

Resting on Feet of Clay: Securely Bootstrapping OPC UA Deployments

15 / 15